What to look for in a managed detection and response solution

In the arms race between bad actors and the organizations they target, managed detection and response (MDR) solutions are more important than ever. Data breaches exposed 5 billion records worldwide in 2018. In the U.S. alone, the average total cost of a data breach was $7.91 million.

MDR is an outsourced security solution that combines technology and resources to provide threat detection, analytics, forensic capabilities, breach response and additional support on a 24x7 basis. MDR solutions include the services of security researchers, analysts and engineers who monitor network environments, analyze security incidents and respond as needed.

MDR is often identified alongside managed security services provider solutions, although the two are not mutually inclusive. While some MSSPs have advanced their capabilities by providing MDR services, such as detecting lateral movement inside a network, most MSSP solutions focus on traditional prevention-based techniques. Garter warned in a May 2017 market guide that “clients should be wary of claims from traditional MSSPs on their ability to deliver MDR-like services. Delivering these services requires technologies not traditionally in scope for MSS.”

MSSPs use log management, log monitoring, vulnerability scanning and security device management and often incorporates information gained from these activities into a security incident and event management (SIEM) platform. They can then notify organizations about threats if certain rules and signatures match.

MSSPs can support a number of valuable security needs such as managing firewalls, but their analysis does not necessarily involve extensive forensics, threat research and analytics. They often focus more on known threats, such as vulnerability exploits, recurring malware infections and high-volume attacks. Moreover, these capabilities are often reactive, not proactive -- essentially spotting a security issue,  but not providing details on the who, what, when, where, why and how. These are the tenets of information gathering and should be at the center of data an MDR solution provides.

MDR solutions can enhance MSSP services with additional analytic and response capabilities. Equally important, MDR provides automated response to file-less malware, advanced persistent threats, hidden breaches and other events.

More resources for cybersecurity

MDR providers can help organizations address the growing cyber talent scarcity. According to recent predictions by Cybersecurity Ventures, the cybersecurity sector will have as many as 3.5 million unfilled positions by 2021. Organizations can use MDR outsourced services to help manage advanced threats that their in-house IT team might not be able to completely address -- and often at a cost lower than that of building a specialized security team themselves.

Organizations leveraging MDR can access capabilities they may not have in place or better utilize resources they already have -- either through augmentation or by allowing the use of more available or lower cost resources with MDR taking the heaving lifting. MDR can also offer access to advanced tools that the organization may not have available.

MDR services also help to establish proactive security controls, as recommended by Gartner, IDC and the National Institute of Standards and Technology among others. Preventative tools and SIEM services are not enough to ensure an environment is not vulnerable, leading to the long (180+ day average) dwell times we see now -- directly correlated to the financial and other damage done by adversaries.

Key elements of an MDR solution

Every organization is unique in its cybersecurity needs. Resources, IT infrastructure, budgets and business goals are all different. Still, all organizations considering an MDR solution should keep in mind the following components and capabilities.

First, any MDR solution should provide 24x7 access to a security operations center via support tickets, email, phone and chat. SOC staff should include trained security analysts who work together to detect, analyze, respond to, report on and prevent cybersecurity incidents. Additional capabilities of some SOCs can include advanced forensic analysis, cryptanalysis and malware reverse engineering to analyze incidents. For growing organizations, these services should be available in a range of plans and prices -- MDR is never a one-size-fits-all solution.

In terms of technology, an agentless, application programming interface-driven platform for MDR can speed deployment by eliminating the need for preinstalled software -- especially with ephemeral instances and serverless assets. The solution should also have the capability to protect an organization’s assets on the cloud the same way on-premise networks, servers and workstations are protected. In addition, the solution’s architecture should support cloud workload protection platforms and workload-centric security offerings that target the protection requirements of server workloads in cloud-based data centers. This can provide consistent visibility and control for physical machines, virtual machines, containers and serverless workloads, regardless of location.

At the core of an MDR solution are capabilities for detecting, analyzing and responding to malware threats. For threat detection, the solution must find known threats and unknown/unidentified threats, ideally operating independently of the operating system. It should hunt within memory, with discovery and analysis of injected code, rogue threads, overwrites, hooks and file-less malware via automatic memory extraction. It should also hunt for persistent threats, collecting and analyzing triggers for dormant and time-delayed malware or malicious commands.

Analytic capabilities can include root-cause analysis tools that help incident response teams trace the source of suspicious activity or identified threats across the environment. Properly designed, these tools should quickly correlate and combine the historical activity of identified threats and malicious leads in a single activity timeline, so that responders can get a clear picture of how, where and when the attack started -- in addition to how it has evolved and moved laterally through the IT environment over time.

In the same way, cybersecurity compromise assessment tools can verify whether a network has been breached and quickly identify the presence of known or zero-day malware and advanced persistent threats that have evaded existing cybersecurity defenses.

Compromise assessments should validate everything currently running, previously ran and scheduled to run on endpoints and analyze each system's volatile memory to discover signs of manipulation or hidden processes.

Finally, MDR capabilities should define and manage dwell time, counteract stealth attack techniques like automorphic malware and provide the ability to conduct periodic reviews in a fast, easy and efficient way.

As noted above, every organization is different in its cybersecurity needs. But properly designed and implemented, an MDR solution can provide a cost-effective, scalable and efficient way to address today’s cybersecurity issues.

Editor's note: This article was changed June 25 to attribute the number of predicted unfilled cybersecurty jobs to research by Cybersecurity Ventures.